Website cannot write to files or create directories

Question

I've been trying to install TeemIP for about 6+ months now and I've never been able to figure out this issue on Centos7.

The error I get is the following:

• The directory '/var/www/teemip/public_html/web/log' exists but is not writable for the application.

• TeemIp needs the directory '/var/www/teemip/public_html/web/env-production' to be writable. The directory '/var/www/teemip/public_html/web/env-production' does not exist and '/var/www/teemip/public_html/web/' is not writable, the application cannot create the directory 'env-production' inside it.

• TeemIp needs the directory '/var/www/teemip/public_html/web/env-production-build' to be writable. The directory '/var/www/teemip/public_html/web/env-production-build' does not exist and '/var/www/teemip/public_html/web/' is not writable, the application cannot create the directory 'env-production-build' inside it.

• TeemIp needs the directory '/var/www/teemip/public_html/web/conf' to be writable. The directory '/var/www/teemip/public_html/web/conf' does not exist and '/var/www/teemip/public_html/web/' is not writable, the application cannot create the directory 'conf' inside it.

• The directory '/var/www/teemip/public_html/web/data' exists but is not writable for the application.

I have created a user and group called www-data for the apache httpd and the permissions are as follows:

[root@TeemIP html]# ls -l
total 648     
drwxrwsr-x. 3 www-data www-data     24 Apr  7 21:24 addons
drwxrwsr-x. 3 www-data www-data   4096 Apr  7 21:24 application
-rwxrwxr-x. 1 www-data www-data    245 Apr  7 21:24 approot.inc.php
drwxrwsr-x. 3 www-data www-data   4096 Apr  7 21:24 core
drwxrwsr-x. 6 www-data www-data   4096 Apr  7 21:24 css
drwxrwsr-x. 2 www-data www-data     58 Apr  7 21:24 data
drwxrwsr-x. 3 www-data www-data     17 Apr  7 21:24 datamodels
drwxrwsr-x. 2 www-data www-data   4096 Apr  7 21:24 dictionaries
drwxrwsr-x. 2 www-data www-data     30 Apr  7 21:24 documentation
drwxrwsr-x. 2 www-data www-data     24 Apr  7 21:24 extensions
drwxrwsr-x. 4 www-data www-data   8192 Apr  7 21:24 images
-rwxrwxr-x. 1 www-data www-data   1030 Apr  7 21:24 index.php
drwxrwsr-x. 7 www-data www-data   4096 Apr  7 21:24 js
drwxrwsr-x. 7 www-data www-data     84 Apr  7 21:24 lib
drwxrwsr-x. 2 www-data www-data     58 Apr  7 21:24 log
-rwxrwxr-x. 1 www-data www-data 603311 Apr  7 21:24 manifest.xml
drwxrwsr-x. 2 www-data www-data   4096 Apr  7 21:24 pages
drwxrwsr-x. 3 www-data www-data     55 Apr  7 21:24 portal
drwxrwsr-x. 5 www-data www-data   4096 Apr  7 21:24 setup
drwxrwsr-x. 5 www-data www-data     73 Apr  7 21:24 sources
drwxrwsr-x. 2 www-data www-data    141 Apr  7 21:24 synchro
-rwxrwxr-x. 1 www-data www-data    630 Apr  7 21:24 web.config
drwxrwsr-x. 2 www-data www-data   4096 Apr  7 21:24 webservices

From what I understand, the application, TeemIP, is using the http daemon to write to logs and create directories. The httpd.conf file includes the www-data user and group, the config is below.

# Dynamic Shared Object (DSO) Support
#
# To be able to use the functionality of a module which was built as a DSO you
# have to place corresponding `LoadModule' lines at this location so the
# directives contained in it are actually available _before_ they are used.
# Statically compiled modules (those listed by `httpd -l') do not need
# to be loaded here.
#
# Example:
# LoadModule foo_module modules/mod_foo.so
#
Include conf.modules.d/*.conf

#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User www-data
Group www-data

# 'Main' server configuration
#
# The directives in this section set up the values used by the 'main'
# server, which responds to any requests that aren't handled by a
# <VirtualHost> definition.  These values also provide defaults for
# any <VirtualHost> containers you may define later in the file.
#
# All of these directives may appear inside <VirtualHost> containers,
# in which case these default settings will be overridden for the
# virtual host being defined.
#

#
# ServerAdmin: Your address, where problems with the server should be
# e-mailed.  This address appears on some server-generated pages, such
# as error documents.  e.g. [email protected]
#
ServerAdmin root@localhost

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify

I tried: Apache2 permissions issue

I also tried changing the user and group to a sudo user and group, but it didn't make a difference. I changed the owner of the /var/www directory to www-data and changed the permissions of the /var/www directory to 775 (recursively). Also, I created the www-data user and group specifically for the apache daemon, but I didn't do anything more than adduser user and groupadd group.

Let me know if you need any other information. I am not sure where else to look, as I do not have intermediate or expert level knowledge on Linux systems.

Answer 1

SELinux is there for a reason. It enforces access restrictions above the standard file system permissions and really makes your server more secure.

You should try to make this work with SELinux enforced :-)

You need to figure out which TeemIP web directories are to be readonly and which are to be writable by Apache. Then, using the instructions in https://wiki.centos.org/HowTos/SELinux (specifically the parts about relabeling files [5.2]), relabel the directories accordingly.

You would typically use semanage fcontext -a -t httpd_sys_content_t "/<pathspec>(/.*)?" for readonly directories and semanage fcontext -a -t httpd_sys_rw_content_t "/<pathspec>(/.*)?" for writable directories. Then, run a restorecon -Rv on the webroot to see the magic happen.

Using commands like ausearch -ts recent -m avc -i while running in permissive mode (setenforce 0) you can check the SELinux audit log for access problems. You may even get hints how to fix SELinux errors by issueing audit2why -a or piping individual audit log entries to audit2why.

Once TeemIP works without triggering new entries in the SELinux audit log, you're good to go: setenforce 1.

Good luck!

Answer 2

I run into similar issues today and decided to write quick answer for the impatient with respect to SELinux read/write permissions.

Getenforce # see current mode.
getsebool -a # find al boolean values
Sudo setenforce 0 # shut it down, but its back at reboot -NOT RECOMMENDED other than debug.

Permanent solution below. Line 2 will work but won't survive rename & restorecon (line 3 will survive such things).

 ls -dZ /var/www/html  # See SELinux context of 
 sudo chcon -R -t httpd_sys_content_t /var/www/html/website-document-root
 sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html(/.*)?" 

I have also done the following in the past to give apache write permission.

Selinux allow httpd read & write to /var/www/html/my-project.

sudo chcon -R -t httpd_sys_script_rw_t /var/www/html/my-project/
sudo chcon -R -t httpd_sys_script_rw_t /var/www/my-Symfony-project/var/log/

SELinux references: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-managing_confined_services-the_apache_http_server-types

Answer 3

The solution is to disable SELinux with the command "setenforce 0". To permanently allow this directory to be written and files to be changed, either disable SELinux or set SELinux enforcement to permissive mode by doing the following:

1. Type the command: "nano /etc/selinux/config"
2. Change the line "SELINUX=Enforcing" to "SELinux=Permissive" OR "SELinux=Disabled" (depending on whether or not you want SELinux to log actions that break its policy)
3. Type the command: "reboot"